Recent years have seen a sharp increase in the number of underage users in virtual reality (VR), where security and privacy (S\&P) risks such as data surveillance and self-disclosure in social interaction have been increasingly prominent. Prior work shows children largely rely on parents to mitigate S\&P risks in their technology use. Therefore, understanding parents' S\&P knowledge, perceptions, and practices is critical for identifying the gaps for parents, technology designers, and policymakers to enhance children's S\&P. While such empirical knowledge is substantial in other consumer technologies, it remains largely unknown in the context of VR. To address the gap, we conducted in-depth semi-structured interviews with 20 parents of children under the age of 18 who use VR at home. Our findings highlight parents generally lack S\&P awareness due to the perception that VR is still in its infancy. To protect their children's interactions with VR, parents currently primarily rely on active strategies such as verbal education about S\&P. Passive strategies such as using parental controls in VR are not commonly used among our interviewees, mainly due to their perceived technical constraints. Parents also highlight that a multi-stakeholder ecosystem must be established towards more S\&P support for children in VR. Based on the findings, we propose actionable S\&P recommendations for critical stakeholders, including parents, educators, VR companies, and governments.